CVE-2024-3567 Qemu-kvm: net: assertion failure in update_sctp_checksum()

2024-04-1014:32:02

CWE-617

redhat

github.com

qemu

assertion failure

update_sctp_checksum

denial of service

net

fragmented packet

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

5.3

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.